Nslookup

nslookup-io/nslookup-mcp

Connects Claude to nslookup.io's DNS infrastructure with 11 tools covering lookups across all 53 DNS record types, propagation checks across 18 global servers, and SSL certificate validation. The standout is dns_health, which runs 39 automated checks across DNSSEC, MX configuration, nameserver hygiene, and CAA records with severity scoring. Also includes security scanning for SPF/DKIM/DMARC, multi-region uptime checks from 7 locations, and GEO scoring to measure how well a domain presents itself to AI crawlers. Available as a remote connector at mcp.nslookup.io/mcp or via npx locally. Reach for this when you're debugging DNS issues, auditing domain security posture, or need to verify propagation without leaving your editor.

GitHub stars: 23
tools: 23
transport: STDIO, HTTP
last updated: Jul 17, 2026

View on GitHub

Install

From registry metadata

$ npx add-mcp https://mcp.nslookup.io/mcp --name nslookup

Run in your terminal. add-mcp asks which agents to add it to (Claude Code, Codex, Cursor and more). Add -g to install it for every project.

Review the command, arguments and environment values before installing. MCP servers run with your local permissions.

Other ways

Claude Code

$ claude mcp add --transport http nslookup https://mcp.nslookup.io/mcp

Run in your terminal. Add --scope user to make it available in every project.

Tools

Verified live · 23 tools

Verified live against the running server on Nov 6, 2026.

dns_lookupLook up all common DNS records (A, AAAA, NS, MX, TXT, CNAME, SOA) for a domain. Returns results from a specified DNS server.2 params

Look up all common DNS records (A, AAAA, NS, MX, TXT, CNAME, SOA) for a domain. Returns results from a specified DNS server.

Parameters* required

domain*string

Domain name to look up (e.g. example.com)

serverstring

DNS server to query. Default: cloudflare. Use 'authoritative' for the domain's own nameservers.one of cloudflare · cloudflare2 · google · quad9 · opendns · authoritative

dns_recordLook up a specific DNS record type for a domain. Supports 53 record types including A, AAAA, MX, TXT, CNAME, SOA, PTR, CAA, SRV, DNSKEY, DS, TLSA, HTTPS, SPF, and more.3 params

Look up a specific DNS record type for a domain. Supports 53 record types including A, AAAA, MX, TXT, CNAME, SOA, PTR, CAA, SRV, DNSKEY, DS, TLSA, HTTPS, SPF, and more.

Parameters* required

domain*string

Domain name (or IP address for PTR lookups) to query (e.g. example.com)

serverstring

DNS server to query. Default: cloudflare. Use 'authoritative' for the domain's own nameservers.one of cloudflare · cloudflare2 · google · quad9 · opendns · authoritative

type*string

DNS record type (e.g. A, MX, TXT, CNAME, SPF, HTTPS, DNSKEY)one of A · AAAA · AFSDB · APL · AXFR · CAA

dns_propagationCheck DNS propagation for a domain across 18+ global DNS servers (Cloudflare, Google, Quad9, OpenDNS, regional servers, and authoritative nameservers). Shows if DNS changes have propagated worldwide.2 params

Check DNS propagation for a domain across 18+ global DNS servers (Cloudflare, Google, Quad9, OpenDNS, regional servers, and authoritative nameservers). Shows if DNS changes have propagated worldwide.

Parameters* required

domain*string

Domain name to check propagation for (e.g. example.com)

recordType*string

DNS record type to check (e.g. A, AAAA, MX, NS, TXT, CNAME)one of A · AAAA · AFSDB · APL · AXFR · CAA

webserversGet the IP addresses (both IPv4 and IPv6) for a domain by looking up A and AAAA records. Also returns the punycode and unicode domain representations.1 params

Get the IP addresses (both IPv4 and IPv6) for a domain by looking up A and AAAA records. Also returns the punycode and unicode domain representations.

Parameters* required

domain*string

Domain name to look up IP addresses for (e.g. example.com)

ssl_certificateCheck the SSL/TLS certificate for a domain. Returns issuer, expiry date, days until expiry, certificate chain validity, cipher strength, SAN domains, fingerprint, and TLS protocol version.1 params

Check the SSL/TLS certificate for a domain. Returns issuer, expiry date, days until expiry, certificate chain validity, cipher strength, SAN domains, fingerprint, and TLS protocol version.

Parameters* required

domain*string

Domain name to check SSL certificate for (e.g. github.com)

bimi_vmcCheck BIMI (Brand Indicators for Message Identification) and VMC (Verified Mark Certificate) for a domain. Returns BIMI DNS record status, VMC certificate details, logo URL, trademark info, and expiry.1 params

Check BIMI (Brand Indicators for Message Identification) and VMC (Verified Mark Certificate) for a domain. Returns BIMI DNS record status, VMC certificate details, logo URL, trademark info, and expiry.

Parameters* required

domain*string

Domain name to check BIMI/VMC for (e.g. google.com)

security_scanRun a security scan on a domain to detect DNS misconfigurations, missing SPF/DKIM/DMARC records, cookie security issues, and other web security vulnerabilities. Returns findings with severity levels (critical, high, medium, low, info).1 params

Run a security scan on a domain to detect DNS misconfigurations, missing SPF/DKIM/DMARC records, cookie security issues, and other web security vulnerabilities. Returns findings with severity levels (critical, high, medium, low, info).

Parameters* required

domain*string

Domain name to security scan (e.g. example.com)

uptime_checkPerform a one-time HTTP uptime check on a URL from a single location. Returns whether the site is up or down, HTTP status code, and response time in milliseconds. For multi-location checks, use uptime_check_multi instead.2 params

Perform a one-time HTTP uptime check on a URL from a single location. Returns whether the site is up or down, HTTP status code, and response time in milliseconds. For multi-location checks, use uptime_check_multi instead.

Parameters* required

timeoutnumber

Timeout in milliseconds (default: 10000)

url*string

Full URL to check (e.g. https://github.com)

uptime_check_multiCheck if a website is up or down from 7 global locations simultaneously: Amsterdam, Sydney, London, Frankfurt, Delhi, Warsaw, and South Carolina. Returns status, response time, and HTTP status code for each location.2 params

Check if a website is up or down from 7 global locations simultaneously: Amsterdam, Sydney, London, Frankfurt, Delhi, Warsaw, and South Carolina. Returns status, response time, and HTTP status code for each location.

Parameters* required

timeoutnumber

Timeout in milliseconds (default: 30000)

url*string

Full URL to check (e.g. https://github.com)

dns_healthRun a comprehensive DNS health audit on a domain — 39 checks across 7 categories: DNSSEC (chain of trust, algorithms, validation), MX & email (PTR, MTA-STS, redundancy), DNS hygiene (SPF conflicts, wildcards, apex CNAME), TTL & SOA configuration, nameserver setup (diversity, l...1 params

Run a comprehensive DNS health audit on a domain — 39 checks across 7 categories: DNSSEC (chain of trust, algorithms, validation), MX & email (PTR, MTA-STS, redundancy), DNS hygiene (SPF conflicts, wildcards, apex CNAME), TTL & SOA configuration, nameserver setup (diversity, l...

Parameters* required

domain*string

Domain name to check DNS health for (e.g. example.com)

geo_checkerCheck a domain's GEO (Generative Engine Optimization) score — how well the site is optimized for AI search engines like ChatGPT, Gemini, Claude, and Perplexity. Returns three scores (Technical Readiness, Entity Readiness, Answer Readiness), AI crawler access status, structured...1 params

Check a domain's GEO (Generative Engine Optimization) score — how well the site is optimized for AI search engines like ChatGPT, Gemini, Claude, and Perplexity. Returns three scores (Technical Readiness, Entity Readiness, Answer Readiness), AI crawler access status, structured...

Parameters* required

domain*string

Domain name to check GEO score for (e.g. github.com)

rdap_lookupLook up registration data (RDAP — the successor to WHOIS) for an IP address, AS number, or domain name. The query type is detected automatically. Returns the owning organization, network range/CIDR, RIR (ARIN, RIPE, APNIC, LACNIC, AFRINIC), country, status, registration/last-c...1 params

Look up registration data (RDAP — the successor to WHOIS) for an IP address, AS number, or domain name. The query type is detected automatically. Returns the owning organization, network range/CIDR, RIR (ARIN, RIPE, APNIC, LACNIC, AFRINIC), country, status, registration/last-c...

Parameters* required

query*string

What to look up: an IPv4/IPv6 address (e.g. 8.8.8.8), an AS number (e.g. AS13335 or 13335), or a domain name (e.g. example.com)

hosting_reportFind out who hosts a website. Returns the hosting provider, IP/ASN/network owner, server location, DNS/nameserver provider, CDN or proxy detection (Cloudflare, Fastly, etc.), SSL certificate issuer, and mail servers/provider for a domain in one combined report.1 params

Find out who hosts a website. Returns the hosting provider, IP/ASN/network owner, server location, DNS/nameserver provider, CDN or proxy detection (Cloudflare, Fastly, etc.), SSL certificate issuer, and mail servers/provider for a domain in one combined report.

Parameters* required

domain*string

Domain or URL to build a hosting report for (e.g. github.com). URLs are normalized to a bare hostname.

domain_scannerScan a domain's email security posture: SPF, DKIM, DMARC, and BIMI configuration. Returns per-indicator scores and detected issues so you can see how well the domain is protected against spoofing and phishing.1 params

Scan a domain's email security posture: SPF, DKIM, DMARC, and BIMI configuration. Returns per-indicator scores and detected issues so you can see how well the domain is protected against spoofing and phishing.

Parameters* required

domain*string

Domain name to scan (e.g. example.com)

dns_change_reviewReview proposed DNS changes BEFORE applying them. Compares a domain's current public DNS with a proposed future state, returns a diff, deterministic rule-based findings (SPF/DMARC/MX/CAA/DNSSEC pitfalls, dangling records, mail breakage, etc.) with suggested fixes, and an overa...3 params

Review proposed DNS changes BEFORE applying them. Compares a domain's current public DNS with a proposed future state, returns a diff, deterministic rule-based findings (SPF/DMARC/MX/CAA/DNSSEC pitfalls, dangling records, mail breakage, etc.) with suggested fixes, and an overa...

Parameters* required

domain*string

Domain whose current public DNS will be compared against the proposed records (e.g. example.com)

records*value

The proposed (future) DNS state: either BIND zone-file text or an array of {type, name?, value, ttl?, priority?} records. This is the COMPLETE desired state for the zone — records present now but o...

serverstring

DNS server to use when fetching the current records. Default: cloudflare.one of cloudflare · cloudflare2 · google · quad9 · opendns · authoritative

bimi_checkCheck only the BIMI (Brand Indicators for Message Identification) DNS record for a domain — faster than bimi_vmc because it skips the VMC certificate download and validation. Returns the BIMI record at default._bimi.<domain>, logo URL, and authority (VMC) URL if declared.1 params

Check only the BIMI (Brand Indicators for Message Identification) DNS record for a domain — faster than bimi_vmc because it skips the VMC certificate download and validation. Returns the BIMI record at default._bimi.<domain>, logo URL, and authority (VMC) URL if declared.

Parameters* required

domain*string

Domain name to check the BIMI record for (e.g. easydmarc.com)

status_pageRead a public status page hosted on nslookup.io status pages. Returns the page name, overall status, per-component status and uptime, and active incidents/maintenance. Look up by slug (pages served at hosted.nslookup.io/<slug>) or by the custom domain the page is served on. Pr...2 params

Read a public status page hosted on nslookup.io status pages. Returns the page name, overall status, per-component status and uptime, and active incidents/maintenance. Look up by slug (pages served at hosted.nslookup.io/<slug>) or by the custom domain the page is served on. Pr...

Parameters* required

domainstring

Custom domain the status page is served on (e.g. status.acme.com)

slugstring

Status page slug (e.g. 'nslookup-io' for hosted.nslookup.io/nslookup-io)

my_overviewGet an account health snapshot for your NsLookup.io monitoring: an aggregated 0-100 health score with per-subsystem breakdown (uptime, SSL, DNS, propagation, VMC, WHOIS) plus your current product limits/quota. Requires sign-in to your NsLookup.io account (or an API token).

Get an account health snapshot for your NsLookup.io monitoring: an aggregated 0-100 health score with per-subsystem breakdown (uptime, SSL, DNS, propagation, VMC, WHOIS) plus your current product limits/quota. Requires sign-in to your NsLookup.io account (or an API token).

No parameters. Call it with no arguments.

my_monitorsList all monitors in your NsLookup.io account across every type — uptime, API, DNS, WHOIS, DNS propagation, SSL certificates, and BIMI/VMC — with their configuration and latest known state. Requires sign-in to your NsLookup.io account (or an API token).

List all monitors in your NsLookup.io account across every type — uptime, API, DNS, WHOIS, DNS propagation, SSL certificates, and BIMI/VMC — with their configuration and latest known state. Requires sign-in to your NsLookup.io account (or an API token).

No parameters. Call it with no arguments.

my_incidentsList incidents from your NsLookup.io monitoring (downtime, SSL expiry, DNS changes, propagation issues, VMC problems) — open ones by default, or the full recent history — plus a per-status/per-source summary. Requires sign-in to your NsLookup.io account (or an API token).2 params

List incidents from your NsLookup.io monitoring (downtime, SSL expiry, DNS changes, propagation issues, VMC problems) — open ones by default, or the full recent history — plus a per-status/per-source summary. Requires sign-in to your NsLookup.io account (or an API token).

Parameters* required

limitinteger

Maximum incidents to return (default 20)

statusstring

'open' (default) = unresolved incidents (triggered or acknowledged); 'all' = include resolved historyone of open · all

my_uptime_historyGet uptime and response-time history for one of your NsLookup.io uptime monitors: availability stats plus hourly buckets over the requested window. Identify the monitor by id or by URL. Requires sign-in to your NsLookup.io account (or an API token).3 params

Get uptime and response-time history for one of your NsLookup.io uptime monitors: availability stats plus hourly buckets over the requested window. Identify the monitor by id or by URL. Requires sign-in to your NsLookup.io account (or an API token).

Parameters* required

hoursinteger

History window in hours (default 24)

monitorIdinteger

Monitor id (from my_monitors)

urlstring

Monitor URL to match instead of an id (e.g. https://example.com)

my_dns_changesList recent DNS changes detected on your monitored domains, each with its DNS Change Review risk assessment (0-100 risk score, severity counts, added/removed/modified record counts), plus the latest risk per monitor. Requires sign-in to your NsLookup.io account (or an API token).1 params

List recent DNS changes detected on your monitored domains, each with its DNS Change Review risk assessment (0-100 risk score, severity counts, added/removed/modified record counts), plus the latest risk per monitor. Requires sign-in to your NsLookup.io account (or an API token).

Parameters* required

limitinteger

Maximum reviews to return (default 10)

my_certificatesGet an SSL certificate expiry overview for your monitored domains: per-alert-level counts (ok / warning / critical / expired) and every certificate sorted by soonest expiry, highlighting the ones expiring within 30 days. Requires sign-in to your NsLookup.io account (or an API...

Get an SSL certificate expiry overview for your monitored domains: per-alert-level counts (ok / warning / critical / expired) and every certificate sorted by soonest expiry, highlighting the ones expiring within 30 days. Requires sign-in to your NsLookup.io account (or an API...

No parameters. Call it with no arguments.

Readme

MCP Server for nslookup.io
DNS lookups, SSL certificate checks, security scanning, GEO (AI readiness) scoring, domain intelligence, and your own monitoring account — via the Model Context Protocol.

Website · API Docs · npm · Contact

What is this?

The nslookup.io MCP server gives any MCP-capable AI assistant (Claude, ChatGPT, Cursor, Windsurf, …) direct access to nslookup.io's DNS, certificate, security, and monitoring tools. Ask in plain language — "Run a DNS health check on github.com" or "Which of my SSL certificates expire soonest?" — and the assistant calls the right tool for you.

23 tools total, in two groups:

View the full README on GitHub

Details

Repository: github.com/nslookup-io/nslookup-mcp
Categories: Security & Pentesting, Monitoring & Observability
Package: @nslookup-io/mcp-server
Transport: STDIO, HTTP
Registry: MCP registry, active
Tools verified: Nov 6, 2026

Related Security & Pentesting MCP servers

View all

EchelonGraph CVE & Exposureechelongraph/echelongraph-mcpCVE, KEV, EPSS, SBOM and advisory lookups; per-CVE exposure from Shodan data (© Shodan). Keyless.21stars

FAOSTAT MCPberba-q/faostat-mcpFAOSTAT data for 245 countries: crops, trade, food security, and emissions via 23 MCP tools.20stars

Npm Sentinel Mcpnekzus/npm-sentinel-mcpAdvanced NPM analysis: Recursive security scanning, ecosystem awareness, and deep insights.18stars

Nekzus Npm Sentinel Mcpnekzus/npm-sentinel-mcpProvide AI-powered real-time analysis and intelligence on NPM packages, including security, depend…17stars

Prism Scanneraidongise-cell/prism-scannerSecurity scanner for AI Agent skills, plugins, and MCP servers with A-F grading.11stars

BlackVeil DNS & Email Security Scannermadaburns/bv-mcpDNS and email security scanner with 82 MCP tools for SPF, DMARC, DNSSEC, SSL, and brand audits.0stars